rule win_trochilus_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.trochilus_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83930402010000 33cd 33c0 e8???????? c9 c3 55 }
            // n = 7, score = 100
            //   83930402010000       | adc                 dword ptr [ebx + 0x10204], 0
            //   33cd                 | xor                 ecx, ebp
            //   33c0                 | xor                 eax, eax
            //   e8????????           |                     
            //   c9                   | leave               
            //   c3                   | ret                 
            //   55                   | push                ebp

        $sequence_1 = { 3bc1 7f7f 3dc01f0000 7f78 8b4704 8bf0 8d4b2c }
            // n = 7, score = 100
            //   3bc1                 | cmp                 eax, ecx
            //   7f7f                 | jg                  0x81
            //   3dc01f0000           | cmp                 eax, 0x1fc0
            //   7f78                 | jg                  0x7a
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   8bf0                 | mov                 esi, eax
            //   8d4b2c               | lea                 ecx, [ebx + 0x2c]

        $sequence_2 = { 83be08010100ff 0f8557ffffff 85ff 740b 57 bee81d0110 e8???????? }
            // n = 7, score = 100
            //   83be08010100ff       | cmp                 dword ptr [esi + 0x10108], -1
            //   0f8557ffffff         | jne                 0xffffff5d
            //   85ff                 | test                edi, edi
            //   740b                 | je                  0xd
            //   57                   | push                edi
            //   bee81d0110           | mov                 esi, 0x10011de8
            //   e8????????           |                     

        $sequence_3 = { 56 ff15???????? 6a02 58 5e 5b c9 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   ff15????????         |                     
            //   6a02                 | push                2
            //   58                   | pop                 eax
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c9                   | leave               

        $sequence_4 = { 0d00e0ffff 40 8d448118 833800 7415 ff7508 8b30 }
            // n = 7, score = 100
            //   0d00e0ffff           | or                  eax, 0xffffe000
            //   40                   | inc                 eax
            //   8d448118             | lea                 eax, [ecx + eax*4 + 0x18]
            //   833800               | cmp                 dword ptr [eax], 0
            //   7415                 | je                  0x17
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8b30                 | mov                 esi, dword ptr [eax]

        $sequence_5 = { ff15???????? 399dd8fbffff 741a ffb5d8fbffff ff15???????? eb0c ff15???????? }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   399dd8fbffff         | cmp                 dword ptr [ebp - 0x428], ebx
            //   741a                 | je                  0x1c
            //   ffb5d8fbffff         | push                dword ptr [ebp - 0x428]
            //   ff15????????         |                     
            //   eb0c                 | jmp                 0xe
            //   ff15????????         |                     

        $sequence_6 = { 51 53 56 57 8bf8 8d5f24 53 }
            // n = 7, score = 100
            //   51                   | push                ecx
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   8bf8                 | mov                 edi, eax
            //   8d5f24               | lea                 ebx, [edi + 0x24]
            //   53                   | push                ebx

        $sequence_7 = { e8???????? 85c0 7524 68???????? 6a02 6871010000 68???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7524                 | jne                 0x26
            //   68????????           |                     
            //   6a02                 | push                2
            //   6871010000           | push                0x171
            //   68????????           |                     

        $sequence_8 = { 8b8730020100 894670 8b8734020100 894674 8b8738020100 894678 8b873c020100 }
            // n = 7, score = 100
            //   8b8730020100         | mov                 eax, dword ptr [edi + 0x10230]
            //   894670               | mov                 dword ptr [esi + 0x70], eax
            //   8b8734020100         | mov                 eax, dword ptr [edi + 0x10234]
            //   894674               | mov                 dword ptr [esi + 0x74], eax
            //   8b8738020100         | mov                 eax, dword ptr [edi + 0x10238]
            //   894678               | mov                 dword ptr [esi + 0x78], eax
            //   8b873c020100         | mov                 eax, dword ptr [edi + 0x1023c]

        $sequence_9 = { 8b877c010100 99 bfe8030000 f7ff 66894602 890b }
            // n = 6, score = 100
            //   8b877c010100         | mov                 eax, dword ptr [edi + 0x1017c]
            //   99                   | cdq                 
            //   bfe8030000           | mov                 edi, 0x3e8
            //   f7ff                 | idiv                edi
            //   66894602             | mov                 word ptr [esi + 2], ax
            //   890b                 | mov                 dword ptr [ebx], ecx

    condition:
        7 of them and filesize < 630784
}